CVE-2021-3199: ONLYOFFICE Docs Path Traversal via JWT Image Upload Enables Remote Code Execution

Background

ONLYOFFICE Docs (the ONLYOFFICE Document Server) is an open-source online office suite used to view and collaboratively edit documents, spreadsheets, and presentations, often embedded into other platforms such as file-sharing services, learning management systems, and groupware products via its API. Because ONLYOFFICE Docs is frequently integrated as a backend component within larger products rather than deployed as a single standalone application, a vulnerability in the document server can have a wider blast radius than its direct deployment numbers suggest — any product that embeds a vulnerable version inherits the exposure.

CVE-2021-3199 is a path traversal vulnerability in ONLYOFFICE Docs that, despite being originally disclosed in 2021, has been added to CISA’s KEV catalog in 2026 — a reminder that older, patched vulnerabilities remain actively exploited for years wherever unpatched instances persist. The flaw occurs when JWT (JSON Web Token) authentication is in use, via a /.. sequence in an image upload parameter, and can allow remote code execution.

Technical Mechanism

This vulnerability is classified under CWE-22, Path Traversal (Improper Limitation of a Pathname to a Restricted Directory). The specific condition, per the KEV description, occurs “when JWT is used, via a /.. sequence in an image upload parameter”:

1. ONLYOFFICE Docs supports JWT-based authentication to secure communication between the document server and the services that embed it (e.g., validating that image or document conversion requests originate from a trusted caller).
2. An image upload feature within the document server accepts a parameter that is used, directly or indirectly, to construct a filesystem path for storing the uploaded image.
3. When JWT validation is active, the code path handling the image upload parameter fails to properly sanitize a /.. directory-traversal sequence embedded in that parameter — allowing the attacker to break out of the intended upload/storage directory.
4. Because the application writes attacker-supplied image content to a path the attacker partially controls via the traversal sequence, the attacker can place a file outside the intended sandboxed directory — for example, into a location where the document server (or an underlying component it calls, such as a document conversion or rendering service) will later interpret and execute it, converting the arbitrary file write into remote code execution.

The CVSS 9.8 score indicates this is exploitable over the network with low complexity and no user interaction, consistent with a pre-authentication or token-replay-reachable path traversal leading to RCE.

Real-World Exploitation Evidence

CVE-2021-3199 is listed in CISA’s KEV catalog, added on 2026-10-08 — more than four years after the vulnerability was originally disclosed and patched. This is a clear illustration of a persistent reality in vulnerability management: KEV addition reflects when CISA confirmed active in-the-wild exploitation, which does not necessarily align with original disclosure date. CISA’s criteria require evidence of real-world exploitation, confirming attackers are actively targeting unpatched ONLYOFFICE Docs instances years after a fix became available.

CISA lists knownRansomwareCampaignUse as “Unknown” for this entry, meaning CISA has not confirmed this specific vulnerability is tied to a named ransomware campaign at this time.

No specific threat actor or campaign name has been publicly attributed to exploitation of CVE-2021-3199 in the data available to us. The KEV listing confirms exploitation occurred in the wild; attribution detail has not been made public. ONLYOFFICE’s own changelog entry documenting the fix (version 5.6.3) is the authoritative vendor reference.

Impact Assessment

Given the path-traversal-to-RCE nature of this flaw and its CVSS 9.8 score, successful exploitation can result in complete compromise of the ONLYOFFICE Docs server:

• Confidentiality: RCE on the document server exposes every document processed or stored by the server, including any documents from users or integrated applications that route through it.
• Integrity: An attacker with code execution on the document server can tamper with documents in transit or at rest, modify server configuration, and pivot to other systems reachable from the document server’s network position.
• Availability: Full compromise allows the attacker to disrupt document conversion and editing services for every application embedding the vulnerable ONLYOFFICE Docs instance.

Sector-specific risk: Because ONLYOFFICE Docs is commonly embedded within file-sharing platforms, content management systems, and collaboration tools, this vulnerability’s real risk surface extends to any product bundling a vulnerable version — meaning affected organizations may not even be aware they are running exposed ONLYOFFICE Docs instances if it arrived as a dependency of another platform.

Affected Versions

ONLYOFFICE’s changelog documents the fix as part of the 5.6.3 release line. Organizations should consult the ONLYOFFICE DocumentServer changelog directly for the definitive affected-version boundary:

Given that this CVE was only added to KEV in late 2026, any instance still running a version predating 5.6.3 today should be treated as a high-priority, actively-targeted exposure.

Remediation Steps

CISA’s required action directs applying vendor mitigations consistent with BOD 26-04 risk-based patching guidance and Forensics Triage Requirements, and discontinuing use of the product where mitigation is unavailable.

1. Upgrade ONLYOFFICE Docs / DocumentServer to version 5.6.3 or later immediately — this vulnerability has had a fix available for years, so any still-vulnerable instance should be treated as a priority legacy-patching gap.

# Check installed ONLYOFFICE DocumentServer version
dpkg -l | grep onlyoffice-documentserver
# or, for Docker deployments:
docker exec <documentserver-container> cat /var/www/onlyoffice/documentserver/healthcheck.json 2>/dev/null

2. Inventory all embedded instances. Because ONLYOFFICE Docs is frequently bundled inside other platforms, audit any third-party product in your environment that integrates document editing/conversion functionality to confirm whether it ships an embedded, potentially outdated ONLYOFFICE Docs component.
3. Restrict JWT-authenticated endpoint exposure to trusted integrating applications only — do not expose the document server’s upload/conversion API directly to the public internet beyond what integration requires.
4. Follow Forensics Triage Requirements on any long-unpatched, internet-facing instance given confirmed active exploitation — assume compromise and investigate accordingly.
5. Review file storage directories used by the document server for any files placed outside expected upload paths, which could indicate prior exploitation of the traversal flaw.

Detection Guidance

• Review document server access and upload logs for image upload requests containing /.. or encoded equivalents (%2e%2e%2f, ..%2f, double-encoded variants) in filename or path parameters.
• Monitor for files appearing outside the expected upload/storage directory structure on the document server’s filesystem.
• Watch for unexpected process execution or script interpretation events on the document server following an image upload request, which could indicate the traversal was successfully escalated to code execution.
• Exact IDS/WAF signatures should be sourced from current threat intelligence feeds; given the age of this CVE, many mainstream IDS rule sets likely already include coverage — confirm your signature set is current and enabled.

Timeline

References

• ONLYOFFICE DocumentServer Changelog — 5.6.3
• CISA BOD 26-04 — Prioritizing Security Updates Based on Risk
• CISA — BOD 26-04 Implementation Guidance: Forensics Triage Requirements
• NVD — CVE-2021-3199